4 ms·

> Now might be a good time to change your password to something longer, or finally get onboard with 2FA. That “or” should be “and” because a shorter password i

> Now might be a good time to change your password to something longer, or finally get onboard with 2FA. That “or” should be “and” because a shorter password isn’t really useful even if you enable 2FA. I have seen websites that allow brute forcing TOTP tokens, so an on-site or low-latency attack could guess from 500k tokens (6 digit code with look-ahead time of 1 step) in 30 seconds, even if they change frequently. I think that it’s time everyone used a password manager to generate really really long passwords. I set all passwords to 64 characters or the maximum allowable characters. There’s are some stupid businesses (hello, banks!) who have weird password requirements, like “more than 7 but lesser than 10 characters”. In such cases you’re better off with randomly generated passwords than a pattern you can remember.

tialaramex 6y ago
On the server side you can do WebAuthn and not care about conventional passwords. At that point you don't hold any secrets at all, you could actually publish the credentials you hold on file and there's only a modest impact on user privacy and no impact on credential security. > I set all passwords to 64 characters This makes no real sense, if they aren't chosen randomly then having 64 of them makes little difference and might make things worse. If they are chosen randomly then you only need a couple of dozen and you're fine.
- e12e 6y ago
  Somewhat uncharitable reading of gp (unless there was an edit): > I think that it’s time everyone used a password manager to generate really really long passwords. I set all passwords to 64 characters or the maximum allowable characters. So, it's not long or random, but rather long and random. That said, I'd advocate aiming for 96 to 128 bits of entropy - beyond that you just have a password that's tricky to type in, in cases where you cannot copy and paste (eg: boot password). So for large and small letter, numbers and a handful (10) of special characters, that comes to 21 random characters (Log2(72^21)~129).

tialaramex 6y ago

On the server side you can do WebAuthn and not care about conventional passwords. At that point you don't hold any secrets at all, you could actually publish the credentials you hold on file and there's only a modest impact on user privacy and no impact on credential security. > I set all passwords to 64 characters This makes no real sense, if they aren't chosen randomly then having 64 of them makes little difference and might make things worse. If they are chosen randomly then you only need a couple of dozen and you're fine.

e12e 6y ago
Somewhat uncharitable reading of gp (unless there was an edit): > I think that it’s time everyone used a password manager to generate really really long passwords. I set all passwords to 64 characters or the maximum allowable characters. So, it's not long or random, but rather long and random. That said, I'd advocate aiming for 96 to 128 bits of entropy - beyond that you just have a password that's tricky to type in, in cases where you cannot copy and paste (eg: boot password). So for large and small letter, numbers and a handful (10) of special characters, that comes to 21 random characters (Log2(72^21)~129).